September 20, 2019 TLP White: Distribution Unlimited Upcoming Browser DNS Changes and Impact to University IT Operations Executive Summary Changes to how Firefox and Chrome browsers conduct domain name resolution will impact your users and IT operations. When a user navigates to a web page, domain names on that page need to be translated (“resolved”) to their corresponding server IP addresses. This includes the name of the server hosting the page itself, as well as servers hosting content embedded in the page. Name-to-address resolution is typically conducted by university- operated servers or by a university-selected third-party resolver operator. Firefox and Chrome plan to implement a new protocol “DNS over HTTPS” (“DoH”, pronounced “dough”) for this domain name resolution. Chrome will automatically enable DoH only when the browser has already been configured to use specific alternative DoH-capable resolvers (such as Google DNS, OpenDNS, Quad9, etc.) Firefox will automatically enable DoH for all resolutions and substitute its own preferred DNS resolver unless users or IT administrators take certain steps (described below). These changes, intended to improve user privacy and security, provide value when users have reason to distrust their DNS or network provider. However, within institutional networks, the Firefox approach presents challenges to IT security operations, protections, and user support. The institution can take action to mitigate the impact of these changes. We recommend that institutions: • Understand how domain name resolution is conducted at their institution. • Understand how DNS choices can impact user privacy and security. • Identify how their IT security operations and protections may be impacted. • Identify how user support may be impacted. • Understand how reliability, availability, and performance may be impacted. • Decide on a response. • Communicate with your users about this issue. REN-ISAC welcomes questions or feedback on this document. Please contact us at [email protected] What is Changing FIREFOX WEB BROWSER • Starting in late September 2019, the Mozilla Foundation will begin changing how Domain Name Service (DNS) queries are handled in the Firefox web browser.1 Rather than using the DNS settings configured by the user or assigned by the user’s network provider, Firefox will substitute its own preferred DNS recursive resolvers operated by Cloudflare on behalf of the Mozilla Foundation. • This DNS traffic will be encrypted using a new protocol known as "DNS over HTTPS," ("DoH").2 • Individual Firefox users can take steps to disable this change in their browser if they (a) know to do so, and (b) are technically comfortable doing so. • Enterprises can use technical methods to deter Firefox from changing their users' DNS settings. However, individual users can override their provider’s expressed preference if they choose to do so and opt-in to DoH. Because Firefox is using DoH by default, it will be difficult for institutions to completely prevent Firefox’s alternative third-party DoH activity. 1 https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ 2 https://en.wikipedia.org/wiki/DNS_over_HTTPS CHROME WEB BROWSER • Chrome is enabling DoH when it detects the user is already using one of a set of third-party DNS providers capable of supporting DoH; it will upgrade the user's DNS traffic to use DoH with that provider.3 This is scheduled to happen with Chrome version 78, expected on October 22, 2019. • The main difference between Chrome’s implementation of DoH and Firefox’s implementation is that, with Chrome, only users who've voluntarily selected a third-party DNS service are affected (the user or network service provider’s DNS resolver specification is respected). Why This is Important • User Privacy and Security: DoH is intended to increase user privacy by limiting eavesdropping on domain name resolution requests (“what web sites is this person visiting?”). However, • DNS is a Fundamental and Mission Critical Protocol: DNS is a technology that average users know little about but underlies everything users do on the Internet. Anything that impacts DNS operations deserves careful review and management. • Bypassing Institutional DNS "Firewalls": Universities often protect users from phishing and malware by blocking access to known bad domains.4 These protections are conducted on locally managed DNS recursive resolvers or contracted to a service provider. Users of alternative third-party resolvers bypass these protections and may be more likely to become victimized. Some of the alternative providers may provide a level of known bad protections; however, the values, integrity, comprehensiveness, and operational controls are outside of institutional control. The capability for local network and security operators to firewall malicious domains based on information received through threat intelligence sharing or local discovery is bypassed. • Loss of Visibility to DNS Traffic Used to Identify Compromised Systems: Many university cybersecurity teams leverage DNS telemetry to identify compromised systems on campus. When browsers move to third-party DoH, that telemetry is lost to university cybersecurity teams. • Split-Horizon DNS Configurations Could Be Impacted: In certain configurations, DNS servers will answer with different responses based on the location of the client on the enterprise network (typically internal versus external). In some cases, use of third-party resolvers may impact the ability to properly resolve a DNS record because records will always be resolved from the perspective of an outside client regardless of client location. Mozilla has specific heuristics to detect this behavior and refer to the system resolver, but this may not be comprehensive. Chrome does not currently offer the ability to detect this behavior. • Use of Third-Party Recursive Resolvers Complicates End-User Support: Diagnosing Internet issues can be challenging at the best of times. A change to DNS operations, which the user may not be aware of, increases complexity particularly if different applications end up using different DNS services (i.e., the browser uses different DNS services from every other application on the user’s computer). Additionally, one’s user experience may differ from another nearby user. • Performance May Be Impacted: While third-party recursive resolver services often tout their speed as a selling point, user experiences may vary as a result of distant third-party recursive resolvers or subtle protocol nuances. For example, in an effort to respect user privacy, some third-party recursive resolver services don't transmit what's known as EDNS Client Subnet information.5 Without hints as to the user's location, content distribution networks can't optimize delivery of content from nearby cache servers. This, plus the additional latency involved in reaching a remote third-party resolver, may result in users perceiving (and potentially complaining about) "the network being slow." • Reliability and Availability May Be Impacted: When DNS operations are run locally or by an institutionally selected third-party provider, the CIO knows who's responsible; has service level agreements, commitments concerning protection from malicious domains; and has recourse in the case of outages. 3 https://www.chromium.org/developers/dns-over-https 4 RPZ is one technology commonly used for this, see https://dnsrpz.info/ 5 https://en.wikipedia.org/wiki/EDNS_Client_Subnet TLP:WHITE 2 • User Privacy May Be Adversely Impacted: While local network administrators may no longer be able to see user DNS traffic, control of this private data is ceded outside the institution to the third-party operators. These operators may not be subject to the same compliance obligations as the institution itself and have no contractual obligation to the user or institution. Additionally, because of various EDNS extensions, user trackability can actually be enhanced.6 • An Insufficient Privacy and Security Solution: Although DoH affords some privacy and security benefits, it is an insufficient solution when operating outside the institutional network, such as at a coffee shop or while on a mobile device. Much more than just DNS requests is exposed; therefore, an institutional VPN is a more comprehensive choice. Recommendations • Understand Who is Currently Providing Recursive Resolver DNS Service for Your Institution: Is it your IT department or a third-party service? Knowing who's doing DNS for your school may impact your options. Whether using local or contracted responsible parties, you should ensure you've heard their perspective on this important issue. • Understand the Mix of Browser Use at Your Institution: Worldwide, Firefox has a small percentage of the browser market (~5%); Chrome has over 60%. In the U.S., Chrome’s percentage is lower (~50%) due to use of Safari; however, Firefox stays at ~5%.7 These percentages may vary in higher ed. A local survey can be performed by looking at the institution’s own web logs for user-agent strings. • Decide if You Want to Allow, Discourage, or Disallow Use of Third-Party DNS Services. This is a policy decision that should be made by the institution following normal institutional procedures, typically including an understanding of the risks involved and a consultation with interested stakeholders. If you choose to discourage or disallow, refer to: o the section of this document Technical Options for Controlling Browser Behavior, and/or o the institutional